rapid7/metasploit-framework — pull request #4429 by wchen-r7 (2014-12-19 09:30:41+00:00)
Title: Fix #4414 & #4415 - exitfunc and proper null-terminated string

This patch fixes the following for messagebox.rb

**Issue 1 (#4415)**
When exitfunc is none, the payload will not be able to generate due to an "invalid opcode" error. Example of this issue:

```
$ ./msfvenom -p windows/messagebox exitfunc=none -f exe > /tmp/msg.exe
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
invalid opcode near "ebx" at "\"\"" line 106
```

**Issue 2: (#4414)**
After "user32.dll" is pushed onto the stack for the LoadLibrary call, the payload does not actually ensure bl is a null byte, it just assumes it is and uses it to modify the stack to get a null-terminated string.

Fix #4414
Fix #4415

## Verification

- [ ] Run this: ```./msfvenom -p windows/messagebox exitfunc=none -f exe > /tmp/msg.exe```
- [ ] You should not see an error. Also, /tmp/msg.exe should not be an empty file.
- [ ] Drag msg.exe to a Windows XP box
- [ ] Double click on msg.exe, you should see "Hello, from MSF!" like the following:

![screen shot 2014-12-19 at 3 30 07 am](https://cloud.githubusercontent.com/assets/1170914/5502423/5f958e1c-872f-11e4-8513-e4a963bc4be3.png)